Cyber Posture

CVE-2026-33435

HighRCE

Published: 15 April 2026

Published
15 April 2026
Modified
21 April 2026
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0010 28.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33435 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Weblate Weblate. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 requires timely flaw remediation, directly mitigating this CVE by applying the patch released in Weblate 5.17 that filters Git and Mercurial configuration files.

prevent

AC-6 enforces least privilege, limiting project creation and backup access to only necessary users as recommended in the advisory, preventing high-privilege attackers from exploiting the feature.

prevent

SI-10 mandates information input validation at input points like the backup process, directly addressing the lack of filtering on Git and Mercurial config files that enables path traversal and code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Vulnerability in public-facing Weblate web app backup feature allows authenticated high-priv users (project creators) to upload malicious Git/Mercurial configs leading to RCE; directly maps to T1190 for exploiting the exposed app and T1068 for escalating from app-level access to full server code execution (scope change per CVSS).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17.…

more

If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

Deeper analysisAI

CVE-2026-33435 affects Weblate, a web-based localization tool, in versions prior to 5.17. The vulnerability arises because the project backup feature fails to filter Git and Mercurial configuration files, potentially allowing remote code execution under certain circumstances. It is classified under CWE-23 (Relative Path Traversal), CWE-94 (Improper Control of Generation of Code), and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to network accessibility, changed scope, and full impact on confidentiality, integrity, and availability.

An attacker requires high privileges, specifically the ability to create projects, to access the project backup functionality and exploit this issue. Exploitation involves crafting malicious Git or Mercurial configuration files that, when processed during backup, lead to remote code execution on the server. The high attack complexity (AC:H) suggests it demands specific knowledge of the tools and configurations, with no user interaction required beyond authentication.

The issue is addressed in Weblate version 5.17. For those unable to update immediately, the advisory recommends restricting access to the project backup feature, which is limited to users able to create projects, thereby reducing the vulnerability's scope. Relevant details are available in the GitHub security advisory (GHSA-558g-h753-6m33) and the associated pull request (PR #18549).

Details

CWE(s)

Affected Products

weblate
weblate
≤ 5.17

CVEs Like This One

CVE-2025-68398Same product: Weblate Weblate
CVE-2026-21889Same product: Weblate Weblate
CVE-2026-34393Same product: Weblate Weblate
CVE-2026-24126Same product: Weblate Weblate
CVE-2026-34242Same product: Weblate Weblate
CVE-2026-25510Shared CWE-434, CWE-94
CVE-2026-23535Same vendor: Weblate
CVE-2026-24897Shared CWE-434, CWE-94
CVE-2025-12153Shared CWE-434
CVE-2025-12637Shared CWE-94

References